Security questionnaire answers › Access control
How do you manage and review privileged access? How to answer it in a security questionnaire
Why buyers ask this
Administrator accounts can reach everything, so reviewers look for least privilege, approval and regular review.
What a strong answer includes
- Describe how admin rights are requested and approved.
- State review frequency (quarterly is common) and who performs it.
- Mention logging of privileged actions and removal on role change or departure.
Sample answer to adapt
Replace the bracketed parts with your own facts. Only state what is true for your environment.
Privileged access is granted by request with manager and system-owner approval, limited to the minimum needed, and reviewed [quarterly]. Privileged activity is logged centrally. Access is removed within [24 hours] of role change or departure.
Evidence to attach
- Latest access review record
- Joiner/mover/leaver procedure
- Admin account list
Common mistakes
- Permanent standing admin for engineers with no review.
- No evidence the review actually happened.
Answer questionnaires from your own documents
Korrali Trust drafts answers from your policies and evidence so every response traces back to its source, and a person reviews it before it goes out.